The Romanian data protection authority sanctioned a ride-hailing driver for publishing on a social network the personal data of a client, including their identity card and information about the ride, without any legal basis.

Facts and context

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a sanction decision against an authorized natural person, including a fine of €1,000, for breaches related to the legal basis of processing.

The case originated from a complaint denouncing the publication by a driver collaborating with an alternative transport platform of a client's personal data on a social network.

Reasons for the decision

• Obligation of lawfulness of processing (Article 6 of the GDPR): The authority found that the driver, acting as the controller within the scope of his duties, disclosed on a social network platform numerous personal data of a client. These data included their first and last name, the series and number of their identity card, their image, as well as information about the ride performed and approximate locations. The authority concluded that this publication was made without the consent of the data subject and in the absence of any other legal basis provided for in Article 6(1) of the GDPR, thus constituting a breach of the lawfulness obligation.

Authority's decision

Consequently, the authority imposed a fine of €1,000 (equivalent to 5,265 lei) on the authorized natural person.

Lessons learned

This decision reminds that:

• An individual service provider, such as a ride-hailing driver, acts as a controller and is personally responsible for GDPR compliance when processing their clients' data outside the framework defined by the platform for which they operate.
• The publication of personal data on a social network constitutes a full processing operation that must be based on a specific and valid legal basis within the meaning of Article 6 of the GDPR.
• The existence of a contractual relationship with a client alone cannot justify the public disclosure of their data, as such a purpose is incompatible with the performance of the initial service contract.